Healthcheck script for Tailscale running on pfSense

tscheck.sh

#!/bin/sh

QRY='some-hostname-in-your-tailnet.ts.net'
WANT='100.100.101.101'  #expected IP address of that host
RESTART=0
SVC_RC_FILE='/usr/local/etc/rc.conf.d/tailscaled'

if [ -e /var/run/booting ]; then
	logger -t tailscaled "system is booting: skipping check"
	exit 0
fi

if [ ! -e "$SVC_RC_FILE" ]; then
	logger -t tailscaled "$SVC_RC_FILE does not exist"
	exit 0
fi

res=$(awk -F= '/^tailscaled_enable/{gsub("\"",""); print $2; exit}' "$SVC_RC_FILE")
if [ "$res" != YES ] ; then
	[ "$DEBUG" -eq 1 ] && logger -t tailscaled "Tailscale is disabled"
	exit 0
fi

$uptime=$(sysctl -n kern.boottime | awk '{print systime()-$4}')
if [ "$uptime" -lt 300 ]; then
	logger -t tailscaled "uptime: ${uptime}s, skipping check"
	exit 0
fi

if ! service tailscaled status | grep -q 'tailscaled is running' ; then
	RESTART=1
	logger -t tailscaled "Tailscale service is not running"
fi

res=$(dig +time=1 +tries=1 +short -t a $QRY @100.100.100.100)
if [ "$res" != "$WANT" ] ; then
	RESTART=1
	logger -t tailscaled "Quad100 invalid DNS response ($res)"
fi

if ! ifconfig -g Tailscale | grep -q tailscale0 ; then
	RESTART=1
	logger -t tailscaled "tailscale0 does not have interface group set"
fi

res=$(tailscale status --json | jq -r '.Health[] | contains("logged out")')
if [ "$res" = true ]; then
	RESTART=1
	logger -t tailscaled "tailscale is logged out"
	sed -i.bak '/pfsense_tailscaled_authkey.*/d' /usr/local/etc/rc.conf.d/pfsense_tailscaled
fi

if [ "$RESTART" -eq 1 ] ; then
	logger -t tailscaled "Restarting tailscale service"
	pfSsh.php playback svc restart tailscale
	#service tailscaled restart
fi

What

This is a simple healthcheck script that should have no noticable impact on your system. It runs a few quick sanity checks to keep Tailscale up and running.

Specifically, it:

• Makes sure the Tailscale service is running
• Makes sure Quad100 DNS lookups are working
• Fixes a problem with stale auth keys causing a "Tailscale is not online" error after reboots
• Makes sure the tailscale0 interface has its interface group set properly (firewall rule helper)
• If any of these checks fail, the fix will be applied, a message will be logged to syslog, and the Tailscale service will be restarted

How

1. Save the script above to your pfSense, e.g. as /root/tscheck.sh
2. Make it executable with chmod +x /root/tscheck.sh
3. Edit lines 3 & 4 so they refer to hosts in your tailnet. See below for a command to give you the values if you aren't sure.
4. Use the Cron package (install it if you need to) to run this script at a sensible interval (I suggest every 5 minutes):

*/5 * * * *  root  /root/tscheck.sh

This has been tested on pfSense+ 25.07.1, 25.11, and 26.03

Please report any issues you encounter.

Help! What do I use for QRY and WANT?

Run this command from your pfSense shell to get a list of valid options:

tailscale status --json | jq -r '.Peer | to_entries | map(select(.value.DNSName!=""))[].value | "QRY=\(.DNSName)\tWANT=\(.TailscaleIPs | map(select(test(":")|not))[0])"'